letsencrypt/boulder
Boulder
Boulder is a production-grade implementation of the ACME (Automated Certificate Management Environment) protocol, built around the same infrastructure that powers Let's Encrypt. It functions as a full certificate authority that automates the issuance, renewal, and revocation of TLS certificates, supporting multiple key algorithms including RSA, ECDSA, and experimental post-quantum ML-DSA keys.
The project distinguishes itself through its multi-algorithm PKI hierarchy, which builds separate RSA and ECDSA root chains with cross-signing to support dual-algorithm trust paths. It includes a CRL-based revocation model that generates and publishes Certificate Revocation Lists to S3-compatible storage for offline revocation checking, and implements gRPC service authentication by issuing per-service certificates with multiple Subject Alternative Names for internal microservice communication. Private keys are managed through SoftHSM, a software PKCS#11 module that provides hardware-like security without requiring physical HSM hardware.
Boulder provides a complete certificate lifecycle management system, handling domain ownership validation through automated challenges, certificate issuance, revocation processing, and CRL publishing. The project includes a local development CA that runs inside Docker containers for testing ACME client workflows against a real certificate authority, and generates test PKI hierarchies with deterministic key regeneration to avoid redundant creation across test runs. It also supports experimental post-quantum cryptography testing by generating ML-DSA keys and certificates for hybrid cryptographic readiness evaluation.
Features
- ACME Server Implementations - Implements the ACME protocol server that acts as a certificate authority for automated certificate lifecycle management.
- TLS Certificate Management - Automates TLS certificate issuance by processing ACME client requests through domain validation and signing.
- gRPC Service Certificates - Issues per-service certificates with multiple Subject Alternative Names for mutual TLS authentication in internal microservice communication.
- ACME Implementations - Provides a full ACME protocol implementation for automated certificate issuance and management, powering Let's Encrypt.
- Multi-Algorithm Certificate Issuers - Issues X.509 certificates with support for RSA, ECDSA, and experimental ML-DSA key algorithms.
- Certificate Revocations - Processes revocation requests for issued certificates, updating status and publishing to certificate transparency logs.
- CRL Distributors - Publishes and distributes Certificate Revocation Lists to enable offline revocation checking for issued certificates.
- CRL Publishers - Generates and publishes Certificate Revocation Lists to S3-compatible storage for offline revocation checking.
- Multi-Algorithm Root Hierarchies - Builds separate RSA and ECDSA root chains with cross-signing to support dual-algorithm trust paths.
- Domain Validation Protocols - Verifies domain ownership through automated challenges before certificate issuance proceeds.
- S3-Compatible CRL Publishers - Generates and publishes CRLs to an S3-compatible store so relying parties can check certificate revocation status.
- Multi-Algorithm Issuing Intermediates - Requires at least one RSA and one ECDSA issuing intermediate certificate for the certificate authority to operate.
- Software HSM Emulators - Stores private keys in a software PKCS#11 module for hardware-like security without physical HSM hardware.
- Multi-Algorithm PKI Hierarchies - Builds separate RSA and ECDSA root chains with cross-signing to support dual-algorithm trust paths.
- Public Key Infrastructure - Generates and manages certificate hierarchies including roots, intermediates, and cross-signed certificates for testing and production.
- Service-to-Service Certificate Authenticators - Generates certificates for service-to-service authentication, including multi-name certificates for replicated services and internal auth.
- Internal Service Certificate Generators - Creates per-service certificates with multiple names for gRPC authentication, plus certificates for DNS, Redis, and API TLS handlers.
- gRPC Service Certificate Generators - Generates per-service certificates with multiple Subject Alternative Names for internal gRPC mutual TLS authentication.
- Test Certificate Generation - Generates collections of keys and certificates for integration tests, skipping regeneration if the directory already exists.
- Test Certificate Hierarchies - Creates RSA and ECDSA roots, intermediates, cross-signed certs, and CRLs for integration test end-entity certificates.
- SoftHSM Key Stores - Stores private keys in a software PKCS#11 module for hardware-like security without physical HSM hardware.
- ML-DSA Key Generators - Generates ML-DSA keys and certificates for testing hybrid or post-quantum cryptographic readiness.
- ML-DSA Certificate Generators - Generates ML-DSA keys and certificates to test hybrid or post-quantum cryptographic readiness in certificate issuance.
